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Abstract 

We define and study the complexity of robust polynomials for Boolean 
functions and the related fault-tolerant quantum decision trees, where 
input bits are perturbed by noise. We compare several different possible 
definitions. Our main results are 

• For every n-bit Boolean function / there is an n-variate polynomial 
p of degree O(n) that robustly approximates it, in the sense that 
p(x) remains close to f(x) if we slightly vary each of the n inputs of 
the polynomial. 

• There is an 0(n)-query quantum algorithm that robustly recovers 
n noisy input bits. Hence every n-bit function can be quantum 
computed with O(n) queries in the presence of noise. This contrasts 
with the classical model of Feige et al., where functions such as parity 
need 6(nlogn) queries. 

We give several extensions and applications of these results. 



1 Introduction 

In the last two decades, polynomials of many varieties have been used quite 
successfully in complexity theory, both for upper and lower bounds. We study 
a variety here that is tailored to analyzing algorithms with noisy input. 

Robust Polynomials. A robust polynomial for a Boolean function / : {0, l} n - 
{0, 1} is a real multivariate polynomial p(z\, . . . , z n ) such that for every x — 
(xi, . . . , x n ) £ {0, 1}™ and every z — {z\, . . . , z n ) £ W 1 , if Vi : |xj — Zi\ < 1/3 
then \f(x) — p(z)\ < 1/3 (the 1/3 in both cases can be changed to any other 
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positive constant less than 1/2). The robust degree of / is the smallest degree 
of a robust polynomial for /; note that we do not require robust polynomials to 
be multilinear. 

The motivation behind the definition of robust polynomials is twofold. First, 
it can be viewed as a strengthening (restriction) of the notion of approximating 
polynomials. An approximating polynomial for / is a multivariate real poly- 
nomial q that approximates / within an additive term of 1/3 for each Boolean 
input. Approximating polynomials for Boolean functions are of interest in them- 
selves and have been the object of study for quite a while. Their minimal degree 
is tightly related to the decision tree complexity of / ^3E]- Indeed, this "poly- 
nomial method" 0] is one of the main tools for obtaining lower bounds on the 
number of queries in quantum algorithms. One difficulty, however, is that ap- 
proximating polynomials do not directly compose: if f(x\, . . . , x n ) is a Boolean 
function with an approximating polynomial pf and g(yi, . . . , y m ) is a Boolean 
function with an approximating polynomial p g , then the polynomial on n • to 
variables Pf{p g , ■ ■ ■ ,p g ) that is obtained by plugging in a copy of p g for each 
of the Xi, is not necessarily an approximating polynomial for the composed 
function f(g, . . . , g) on n ■ to variables. This difficulty is avoided with robust 
polynomials: if pf,p g are robust for /, g respectively, then their composition is 
a robust polynomial (and thus also approximating) for the composed function. 

A second motivation for robust polynomials is the study of quantum decision 
trees that can tolerate noise in their inputs. We show that a natural quantum 
analogue of classical fault-tolerant decision trees can be defined. As a result, it 
will follow that every such algorithm that uses T queries to its input bits (and 
hence every classical noisy decision tree algorithm as well) implies the existence 
of a robust degree-2T polynomial for the function. This relates the robust 
degree to fault-tolerant quantum query algorithms in exactly the same way 
that approximating polynomials are related to bounded-error quantum query 
algorithms. Surprisingly, our results imply robust quantum algorithms with a 
linear number of queries, as well as robust polynomials of linear degree, for any 
Boolean function. This should be contrasted with the result of Feige et al. [Jj- 
They proved that for most Boolean functions, an overhead factor of fi(logn.) 
on the number of queries is needed in the noisy case compared to the non- 
noisy case. In particular, consider the parity function on n variables. This 
function can be decided trivially by an n-query decision tree, and hence can 
be represented exactly by a real multilinear polynomial of degree n (which is 
just the single monomial containing all variables in the {—1, 1} representation). 
Feige et al. [5] prove that in the noisy decision tree model any algorithm for 
Parity needs Q(n\ogn) queries. Using standard amplification techniques, this 
yields an 0(rtlogn)-degree robust polynomial for Parity. Can one do better? 
Our results imply that there is a robust polynomial for Parity of degree O(n). 
However, we only have an indirect description of this polynomial by means of a 
quantum algorithm, and do not know of an explicit simple construction of such 
a polynomial. 
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Noisy Quantum Queries. We now discuss in more detail the model of noisy 
decision trees in the quantum world. The notion of a "noisy query" in the 
quantum case is not as obvious and natural as in the classical case, because one 
application of a quantum query can address many different a^'s in superposition. 
A first proposal would be that for each quantum query, each of the bits is flipped 
independently with probability e. Each such quantum query introduces a lot 
of randomness and the algorithm's state after the query is a mixed quantum 
state rather than a pure state. In fact, this model is a concrete (and very 
destructive) form of decoherence; the effects of various forms of decoherence on 
oracle algorithms like Grover's have been studied before, see e.g., [TUIIT^] . 

A second model, which we will adopt here, is to assume that we have n 
quantum procedures, Ai, .. . ,A n , such that A; outputs Xi with probability at 
least 1 — e. Such a coherent-noise model is not unreasonable. For instance, it 
could be the case that the input bits are actually computed for us by subroutines. 
Such algorithms can always be made coherent by pushing measurements to the 
end, which means that we can apply and reverse them at will. To enable us to 
apply the Aj's in superposition, we assume we have a black box that maps 

A:\i)\0) ^ \i)Ai\0). 

One application of this will count as one query. 

A third model, which we will call the multiple-noisy- copies model, was stud- 
ied by Szegedy and Chen pi]. Here, instead of Xi, the algorithm can only query 
"perturbed" copies y^i, . . . , j/, im of Xi. The y^j are independent Boolean ran- 
dom variables with Vx\xi = yij] > 1 — e for each i = 1, . . . , n and j = 1, . . . , m. 
In contrast to the first proposal, this model leaves the queries perfectly re- 
versible, since the perturbed copies are fixed at the start of the algorithm and 
the same y^j can be queried more than once. The assumption of this model 
is also stronger than the second model, since we can construct a 1-query Ai 
that just outputs a superposition of all y^j. If m is sufficiently large, this Ai 
will compute Xi with high success probability, satisfying the assumption of the 
second model (see Section [Ql for details). 

Robust Quantum Algorithms. Assuming the second model of noisy queries 
and some fixed e, we call a quantum algorithm robust if it computes / on n inputs 
with bounded error probability when the n inputs are given by bounded-error 
algorithms A%, . . . , A n , respectively. 

A first observation is that every T-query non-robust algorithm can be made 
robust at a multiplicative cost of O(logT). With O(logT) queries, a majority 
gate, and an uncomputation step, we can construct a unitary U x that approxi- 
mates an exact quantum query 

Ux ■ \i)\h) h-> \i)\b® Xi ) 

very well in the standard operator norm: \\U X — U x \\ < 1/(100T). Since er- 
rors add linearly in a quantum algorithm [3], replacing U x by U x in a non- 
robust algorithm gives a robust algorithm with almost the same final state. In 
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some cases better constructions are possible. For instance, a recent result by 
H0yer et al. [7j implies a quantum algorithm that robustly computes the n-bit 
Or function with 0(y/n) queries. This is only a constant factor worse than the 
noiseless case, which is Grover's algorithm 6 . In fact, we do not know of any 
function where the robust quantum query complexity is more than a constant 
factor larger than the non-robust complexity. 

Our main result about robust quantum algorithms (made precise in Theo- 
rem 0U is the following: 

There exists a quantum algorithm that outputs Xi,...,x n , with 
high probability, using O(n) invocations of the Ai algorithms (i.e., 
queries) . 

As already mentioned, this result implies that every n-bit function / can be 
robustly quantum computed with 0(n) queries. This contrasts with the classical 
Q(n\ogn) lower bound for Parity. It is quite interesting to note that quantum 
computers, which usually are more fragile than classical computers, are actually 
more robust in the case of computing Parity in this model with noisy inputs. 
The result for Parity can be extended to every symmetric function: for every 
such function, the optimal quantum algorithm can be made robust with only a 
constant factor overhead (see Section l4~T)l . 

Our result has a direct bearing on the direct-sum problem, which is the 
question how the complexity of computing n independent instances of a function 
scales with the complexity of one instance. One would expect that computing 
n instances with bounded-error takes no more than n times the complexity of 
one instance. However, since we want all n instances to be computed correctly 
simultaneously with high probability, the only known general method in the 
classical world is to compute each instance with error probability reduced to 
0(l/n). This costs another factor of O(logn). In fact, it follows from the 
ri(nlogn) bound for Parity that this factor of logn is optimal if we can only 
run algorithms for individual instances in a black-box fashion. In contrast, our 
result implies that in the quantum world, the bounded-error complexity of n 
instances is at most O(n) times the bounded-error complexity of one instance. 
This is a very general result. For example, it also applies to communication 
complexity JJJ Section 4.1.1]. If Alice and Bob have a bounded-error protocol 
for a distributed function /, using c bits (or qubits) of communication, then 
there is a bounded-error quantum protocol for n instances of /, using 0(n(c + 
logn)) qubits of communication. The additive logn is because Alice and Bob 
need to communicate (possibly in superposition) the index of the instance that 
they are computing. In contrast, the best known general classical solution uses 
O(cTilogn) bits of communication. 

Note about Related Work. In their manuscript jS], Iwama et al. study a 
similar but slightly weaker setting. There, the error probability for each input 
variable is exactly e. If e is known, then one can use a version of exact amplitude 
amplification to "rotate off" the error using 0(1) queries and hence make the 
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algorithm robust. If e unknown, it can be estimated very well using quantum 
amplitude estimation, after which amplitude amplification can be used as if e 
was known. Iwama et al. derive from this that any quantum algorithm can be 
made robust (in their model) with only a constant factor overhead. Their model 
has the disadvantage that it does not cover the subroutine-scenario, where each 
input bit Xi is computed for us by an algorithm or subroutine Ai whose error 
we can only upper bound. Our model does not need the assumption that the 
error is the same for all input bits, and hence does not have this disadvantage. 

2 Robust Polynomials — Preliminaries 

In this section we study robust polynomials of two different but essentially 
equivalent types. The first type arises from the multiple-noisy-copies model, 
the second type is what we discussed in the introduction. 

2.1 Two definitions 

Definition 1 Let e £ [0, 1/2). An (e, m)-perturbation of x £ {0, 1}™ is a matrix 
y of n x m independent binary random variables yij such that Pr[yjj = Xi] > 
1 — e for each 1 < j ' < m. 

Definition 2 A type-1 (e, m)-robust polynomial for the Boolean function f : 
{0, l} n — * {0, 1} is a real polynomial p in nm variables yi.j (with 1 < i < n and 
1 < j < m ) so that for every x 6 {0, 1}™ and y an (e,m) -perturbation of x, we 
have 

Pr[|p(l/) - f(x)\ > 1/3] < 1/3, 

where the probability is taken over the distribution on the nm bits in y. More- 
over, for every v € {0, l} nm , we require —1/3 < p(y) < 4/3. 

Since yfj — ytj for a bit y%,j, we can restrict attention to multilinear polynomials 
here. 

Notice that the error parameter 1/3 in our definition of type-1 polynomial 
is consistent with having expected error more than 1/2 for some x: it could be 
that \p(y) - f(x)\ = 1/3 with probability 2/3, and \p(y) - f{x)\ = 4/3 with 
probability 1/3, giving expected error 2/3. However, this is not a significant 
problem, as the next lemma shows that the error parameter 1/3 can be reduced 
to any small 8 > at only a small multiplicative cost in the degree and the 
number of perturbations. It employs the following Chernoff bound from ^ 
Theorem A. 1.1 6]. 

Theorem 1 (Chernoff) Let Xi, 1 < i < k, be mutually independent random 
variables with all E[Xi] = and all < 1. Set S — Y)j—x Xi. Then Pr[5 l > 
a]<er a2 / 2k . 
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Lemma 1 Consider any 8 > 0. If there is a type-1 (e, m)-robust polynomial p 
for f of degree d, then there exists a type-1 (e, m!)-robust polynomial q for f of 
degree 0(dlog(l/<5)) and m' — 0(mlog(l/<5)), such that for x G {0, 1}™ and y 
an (e, m') -perturbation of x, we have 

Pv[\q(y) - f(x)\ > 6} < 6. 

Moreover, for every v G {0, l}™" 1 we have q(v) € [0, 1]. 

Proof. Wc first analyze the following single-variate "amplification polynomial" 
of degree k: 

h k {x)= (%\l-x) k -\ 

i>k/2 

Note that h k (x) is exactly the probability that among k coin flips with bias x 
towards 1, more than half come up 1. Since it's a probability, we have h k (x) G 
[0, 1] for all x G [0, 1]. Moreover, applying the Chernoff bound with Xi being 
the outcome of the ith coin flip minus x, and a = (1/2 — x)k, we have hk(x) G 
[0,2-°^] for all x G [0,1/3]. Similarly h k (x) G [1 - 2" n ( fe ),l] for x G [2/3,1]. 
By "stretching" the domain a bit, we can turn this into a degree-fc polynomial h k 
such that h k (x) G [0, 2" n ( fe )] for x G [-2/5, 2/5], h k {x) G [0, 1] for x G [2/5,3/5], 
and h k (x) G [1 - 2- Q(k \ 1] for x G [3/5, 7/5]. 

We use r independent (e, m)-perturbations of x, denoted y — yi, . . . , y r , for 
some number r to be determined later. For each perturbation yi it holds that 
P r [\p(Vi) ~ f( x )\ > 1/3] < 1/3- Using the amplification polynomial h k with k = 
0(1) we can get the value of p closer to /: Pr[\h k (p(yi)) — f{x)\ > 1/20] < 1/3. 
Note that the expected value of \h k (p(yi)) — f{x)\ is now at most (2/3)(l/20) + 
(1/3)1 = 11/30. Now define an average polynomial p(y) = ^ Y^i=i hk(p{Ui))- 
Choosing r = 0(log(l/5)), the Chernoff bound (with k = r, and Xi being the 
indicator random variable for the event that \h k (p(yi)) — f(x)\ > 23/60 minus 
its expectation) we have 

p*l\p(y) - f{x)\ > 2/5] < 6. 

Finally we apply h k again, this time with degree k — 0(log(l/<5)), in order to 
get the value of p (5-close to the value f(x): if we define q(y) = h k (p(y)) then 

Mq(v) - m\ > 5} < s. 

The degree of q is 0(dlog(l/5)), and m! = mr = 0(mlog(l/(5)). The last 
property of the lemma is also easily seen. □ 

The second kind of robust polynomial is the following: 

Definition 3 For a Boolean function f : {0,1}" — ► {0,1}, we call q a type-2 
e-robust polynomial for / if q is a real polynomial in n variables such that for 
every x G {0, 1}™ and every z G [0, 1]™ we have \q{z) — f{x)\ < 1/3 if\zi~Xi\ < e 
for all i G [n]. If e — 0, then q is called an approximating polynomial for f. 
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Note that we restrict the z^s to lie in the set [0, e] U [1 — e, 1] rather than the 
less restrictive [— e, e] U [1 — e, 1 + e]. This facilitates later proofs, because it 
enables us to interpret the Zi's as probabilities. However, with some extra work 
we could also use the less restrictive definition here. Also note that a minimal- 
degree type-2 robust polynomial for / need not be multilinear, in contrast to 
the type-1 variety. 

Definition 4 For f : {0,1}™ — > {0,1}, let rdeg 1 (/) denote the minimum de- 
gree of any type-1 (1/3, O (log n) -robust polynomial for f, let rdeg 2 (/) be the 
minimum degree of any type-2 1/3-robust polynomial for f , and let deg(/) be 
the minimum degree among all approximating polynomials for f . 

Strictly speaking, we should fix an explicit constant for the O(logn) of the 
type-1 polynomial, but to simplify proofs we'll use the O(-) instead. 

2.2 Relation between type-1 and type-2 robust polynomi- 
als 

We characterize the relation of type-1 and type-2 robust polynomials as follows: 

Theorem 2 For every type-2 e-robust polynomial of degree d for f there is a 
type-1 (e/2, 0(log(n)/(l/2 — e) 2 ))-robust polynomial of degree d for f . 

Conversely, for every type-1 (e, m)-robust polynomial of degree d for f there 
is a type-2 e-robust polynomial of degree 0(d) for f . 

Proof. Let p be a type-2 e-robust polynomial of degree d for /. We choose 
m = 0(log(n)/(l/2 — e) 2 ). If each yij is wrong with probability < e/2, then the 
Chernoff bound implies that the probability that the average y i — Y]j—i Vi,jl m 
is more than e away from Xi, is at most 1/ (3n). Then by the union bound, with 
probability at least 2/3 we have |j7j — Xi\ < e for all i G [n] simultaneously. Hence 
the polynomial p(y 1: ■ ■ ■ ,y n ) will be a type-1 (e/2, O (log (n)/ (1/2 — e) 2 ))-robust 
polynomial of degree d for /. 

For the other direction, consider a type-1 (e, m)-robust polynomial of degree 
d for /. Using Lemma ^ we boost the approximation parameters to obtain 
a type-1 (e, m') -robust polynomial p of degree 0(d), with m! — O(m), such 
that for any x S {0,1}™ and (e, m')-perturbation y of x, Pr[\p(y) — f(x)\ > 
1/9] < 1/9. For z = (zi, . . . , z n ) define the formal polynomial q(z) (over the 
reals) by replacing each appearance of y^j in p(y) with Z{. For z € R™ with 
< Zi < 1 for all i, let yij (i e [n], j E [m']) be independent 0/1 random 
variables, where Efj/^j] = Zi. Then the polynomial q(z) that is defined above 
can be viewed as q(z) = E\p(y)] because E[p(y)} — p(E[y}) and E^j] = z^. In 
particular, if for z there exists x £ {0, 1}™ with \zi — Xi\ < e for all i, then for 
any V € {0, l}™" 1 that is an (e, m)-perturbation of x, we have q(z) — E[p(y)] 
(here expectation is according to the distribution induced by y). Therefore 
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V := {v e {0, l} nm : \p(v) - f{x)\ < 1/9} has probability Pr[y € V] > 8/9 and 



\m-g(z)\ < 



J2^[V = v] (f(x)-p(v)) 



]T Pr[y = v](l + \ 



v4V 



1 

<3 



This means that q(z) is a type-2 e-robust polynomial for / of degree 0(d). □ 

Note, in all the above we have discussed total Boolean functions. The defini- 
tions above make sense also for partial Boolean functions (or promise problems). 
The theorem as well as the next corollary are true also for such cases. 

Corollary 1 rdeg 1 (/) = 0(rdeg 2 (/)) for every Boolean function f : {0, 1}™ — > 
{0,1}. 

2.3 Polynomials induced by quantum algorithms 

The well known "polynomial method" |2] allows us to make a connection be- 
tween "robust" quantum algorithms and robust type-1 polynomials: 

Lemma 2 Let f : {0, 1}™ — > {0, 1} be a Boolean function. Let Q be a quantum 
algorithm that makes at most T queries on inputs y from {0, l} nxm ; and let Q(y) 
denote the binary random variable that is its output. If for every x € {0, 1}" and 
y an (e, to) -perturbation of x, we have that Pr y [Q(y) = f(x)] > 8/9 (probability 
taken over the distribution on the nm bits in y as well as over the algorithm), 
then there exists a degree-2T type-1 (e,m)-robust polynomial for f. 

Proof. By Lemma 4.2], Q induces a degree-2T multilinear polynomial p 
on nm variables that gives the acceptance probability of Q on fixed input y € 
{0, l} nm , i.e., p(y) = Pr[Q(y) = 1] (probability taken only over the algorithm). 
Fix x € {0,1}™. Suppose fix) = 0, then we want to show that Pr y [p(y) > 
1/3] < 1/3. Since Pr y [Q(y) = f{x) = 0] > 8/9, we have E y \p(y)] = Pv v [Q(y) = 
1] < 1/9. Hence Markov's inequality implies Pr y [p(y) > 1/3] < 1/3 and we are 
done. The case f(x) = 1 is similar. □ 



3 Quantum Robust Input Recovery 

In this section we prove our main result, that we can recover an n-bit string 
x using O(n) invocations of algorithms A\, . . . ,A n where Aj computes X4 with 
bounded error. Let denote the Hamming weight of a bit string x. Our main 
theorem says that with high probability we can find t 1-bits in the input x (if 
they are present) using O(vroT) noisy queries. 

Theorem 3 Let e € [0,1/2). Consider e-error algorithms A\, A n that 
compute the bits x — x±, . . . ,x n . For every t, 1 < t < n, there is a quantum 
algorithm that makes 0{\frvt) queries (invocations of the Ai) and that outputs 
x = $1, . . . ,x n such that with probability at least 2/3 
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1. for all i: Xi = 1 Xi = 1 

2. \x\ > mm{t, \x\}. 

In particular, with ( = nwc obtain x = x using 0(n) queries. 

3.1 Some more preliminaries 

For simplicity we assume that < e < 1/100 is fixed and that Ai is a unitary 
transformation 

A l :|0 t )^a I |0)|^) + yi _ ^f|l)K 1 ) 

for some ct^ > such that < e if x^ = 1 and |a;| 2 > 1 — e if x t = 0; 

\ip®) and are arbitrary norm-1 quantum states. The output is the random 
variable obtained from measuring the first qubit. It equals Xi with probability 
at least 1 — e. It is standard that any quantum algorithm can be expressed in 
this form by postponing measurements (i.e., unitarily write the measurement 
in an auxiliary register without collapsing the state); any classical randomized 
algorithm can be converted into this form by making it reversible and replacing 
random bits by states (|0) + |l))/-\/2. 

We define the following notion of closeness: 

Definition 5 For e £ [0, 1/2) and algorithms A = (A±, . . . , A n ), we say A is 
e-close to x € {0, 1}™ ifPi[Ai outputs x^ > 1 — e for all i £ [n]. 

We sometimes modify our sequence of algorithms A = (A\, . . . , A n ) as follows. 
For an n-bit string x, we negate the answer of At if Xi = 1, and denote the 
resulting sequence of n algorithms by A(x) . Note that Aix) is close to n if and 
only if x — x. In other words, by finding ones in A(x), we find positions where x 
differs from x. In addition, for a set S C [n] we use A (x) to denote the vector 
of algorithms „4(a;) , except that for all t ^ S the ith. algorithm always outputs 
instead of running Ai. Also, for S as above and x £ {0,1}™ we denote by 
x s £ {0, 1}™ the string that is identical to x on indices in S and is on indices 
in S. 

Our algorithm builds on a robust quantum search algorithm by H0yer, 
Mosca, and de Wolf 0, which we call RobustFind. This subroutine takes a 
vector A of n quantum algorithms and in the good case returns an index i 
such that the "high probability" output of is 1. Formally, the input/output 
relation of RobustFind is stated in Theorem 21 

Theorem 4 (H0yer, Mosca, de Wolf f7\) There is a procedure RobustFind(n, 

A, e, /3, 7, S) where n £ N, A : n quantum algorithms, e, f3, 7, 8 > 
Output: i £ [n] U {_L} and with the following properties: 

1. if A is e-close to x £ {0, 1}™ and x has Hamming weight \x\ > (in, then 
i 7^_L with probability > 1 — S 

2. if A is e-close to x £ {0,1}" and if i ^_L ; then Xi — 1 with probability 
> 1 -7 
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Complexity: 



( 




) 



invocations of the Ai 



3.2 The algorithm and its intuition 

Before we formally prove Theorem [3] we explain the intuition and high level of 
our algorithm (as defined by the Alllnputs pseudo code on page !18|) and of the 
proof. Clearly, for t = 0(1) Theorem [3] is obvious as we can run RobustFind t 
times to recover t indices i such that Xi — 1 with 0(y / n) queries. Therefore all 
considerations below will be for t > to for some t$ that is independent of n and 
will be specified later. 

An important feature of the robust quantum search is that it can be used to 
verify a purported solution x S {0, 1}™ by running RobustFind on A{x) to find 
differences with the real input x. 

Let x be the unique assignment such that A is e-close to x. Assume first that 
the Hamming weight is \x\ < 3t/2. Our idea is to apply RobustFind repeatedly 
for about 3t/2 times (with threshold, say, (3 = f/(lQ0n)) and error probability 
1/100. We expect that for at least a 98/100-fraction of the calls, RobustFind 
will return an index i such that Xi = 1, and expect at most a 2/100-fraction of 
wrong indices. The first problem to note is that RobustFind might return the 
same (correct) index over and over again. This is easily resolved as follows: We 
set x e {0, 1}" to be ii = 1 for every index i that we obtained from RobustFind 
and everywhere else, and call RobustFind with A(x) rather than with A. This 
means that the l's that are to be reported by RobustFind are in x © x which 
is supported on the erroneous indices of x, namely, on those indices that are 
either 1 in x but are in X (false positive) and those indices that are on i 
while they are 1 on x (false negative). 

Done this, we expect about 3i/200 errors of both kinds (false positive and 
false negative) in the 3t/2 calls to RobustFind, which should result in i being 
quite close to x. We then call RobustFind 3t/4 times hoping to correct some of 
the errors while not introducing too many new errors. This would be reasonable 
as we call RobustFind in this second phase half the times we call it in the first 
phase. Thus we expect to have half the number of new errors, while good chance 
of correcting many old errors (as they are 1 in x © x and hence RobustFind is 
expected to report a 98/100-fraction of them). We keep doing this until the 
number of expected errors is smaller than t/(log 2 t). At this point we can afford 
to run RobustFind for t/(log 2 t) times, with error probability as low as l/(20i). 
This finds all remaining errors with high probability. Indeed this is the structure 
of part 2 and part 3 of our algorithm. 

However, the idea above fails to work when |a;| ^> t. To see the problem 
assume that t — y/n while \x\ = n/2. Then, after the first round above, x will 
be supported on about y/n indices, out of which about y/n/\QQ might be false 
positives. However, in every next call to RobustFind, the procedure has about 
n/2 — y/n false negative indices to report back - those that are l's in x but still 
in x. Thus, even if all the next 0(t) calls return a correct such index, we still 
might be left with the same -^/n/lOO false positive errors that are introduced 
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in the first round. Note that if t — n, which is the case when the algorithm 
is applied to find all inputs, this last discussion is of no concern. However, for 
relatively small t (which will be needed for some applications, e.g., Theorem [5J 
we need to introduce a first part to the algorithm. This part is only meant to 
find a subset S C [n] such that \x s \ < it/2. Once this is done, we can use x s 
instead of x in the description above, which will now work for every input. 

3.3 Detailed proof 

We now prove that the success probability of the algorithm is at least 2/3. 

Success probability. The algorithm is composed of three parts. We first 
prove that after Part 1, that is, prior to line 9, we have min(£, |x|) < \x s \ < 3i/2 
with probability 1 — o(l). 

Indeed, assume first that just prior to the execution of line 7 we have |S| > 
5t/4. Then the upper bound on \x | is trivial. For the lower bound assume 
(by way of contradiction) that \x s \ < t. Then we can have |5| > 5i/4 only if 
at least i/4 wrong indices have been reported by RobustFind. However, as we 
call RobustFind with 7 = 1/100 we expect at most 3£/200 errors. Thus by the 
Chernoff bound we have \x s \ > t with probability 1 — o(l). 

If, on the other hand, we reach line 7 with |5| < 5£/4 then S is set to be 
[n], for which the lower bound on \x s \ certainly holds. For the upper bound 
assume that |x| > 3t/2. Then to have \S\ < 5t/4 at line 7 means that at least 
i/4 — t/100 errors occurred in the 3t/2 calls for RobustFind (an error here is 
whenever RobustFind returns either i =_L or a false negative index; the t/100 
term comes from the threshold (3 = i/(100n)). However, the error probability 
in this case is at most 2/100 (as we call RobustFind with 5 = 7 = 1/100). Thus 
we expect at most 3£/100 errors. Again by Chernoff we are done. 

Accordingly, we may assume that with probability 1 — o(l), the S we have 
at line 9 is such that min(t, |x|) < \x s \ < it/2. In Part 2 of the algorithm 
we want to find correctly most of the l's in x s . We maintain x as our current 
estimate of x s . Initially x — 0". Denote by Gk, k = 1, . . . , log((log£) 2 ) the event 
that \x © x s \ < 30£fc/100 at the end of the kth run of the loop in line 10; Gk 
denotes the complementary event (the negation of Gk)- We prove inductively 
that Pr[Gk\Gk-i] = e~ n ( tk \ This together with an assertion that Pr[Gi] = 
e _n W w iH imply that at the end of Part 2, \x s ®x\ <t/ log 2 t with probability 
at least 9/10, assuming that t is large enough (such that e - °( tfc ) = e - °(*/ log $ < 
1/(10 log(log 2 i))). 

Indeed, let us examine the situation during the first round, namely for k = 1. 
We call RobustFind in the first round for t\ —3t/2 times with threshold /3%n = 
t/200. Thus, as long as \x s ffi x\ > t/200 happens, each call to RobustFind 
gives an i 6 [n] with probability at least 99/100. Moreover, we expect at most 
a 1/100 fraction of errors in the reported indices. Assume first that at the 
beginning of the first round \x s ® x\ > 20£/100 and let h = \x s © x\ - i/200. 
Then after the first h calls to RobustFind we expect at least 98/100 fraction 
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of correct indices. Thus with probability e~ n ^ we will get less than 90/100 
correct indices. However, if we do get at least j& • \x s © x\ correct indices after 
those h calls we get an x for which \x s © x\ < j^h < 6i/100. Now, assuming 
this happens, then G\ can happen at the end of the first round only if during 
the rest of the 3t/2 — h < 129t/100 remaining calls at least 39i/100 incorrect 
indices have been made. As the probability for an incorrect index is bounded 
by 1/100 we expect only at most 1.3t/100 errors. Thus, by Chernoff 39t/100 
errors will occur with probability e~ n (*\ If, however, at the beginning of the 
first round \x s © x\ < 20i/100 then by a similar argument Gi can happen at 
the end of the first round only if during the 3£/2 calls to RobustFind at least 
25i/100 incorrect indices have been made. Again by Chernoff this will happen 
with probability e _n O. This concludes the proof that Pr[Gi] = e~ n ^\ 

We now inductively prove that Pr[Gfc|Gfc_i] < e ~ n ( tk \ 

Indeed, assume that Gk-i happens, namely that just prior to the beginning 
of the fcth round we have \x (Bx s \ < 30£fc_i/100 = 60£fe/100. In round fc we call 
RobustFind with threshold /3kn = ifc/200; hence, as long as \x © x s \ > ifc/200, 
we expect RobustFind to return an index i G [n] n S with probability at least 
99/100. Moreover, every time it returns a correct index (which occurs with 
probability at least 99/100) it is a 1 in (x © x s ) hence reduces the weight of 
symmetric difference (the total number of errors) by 1. 

Suppose first that prior to round k, \x © x s \ < 30^^/100. Then, for Gk 
to happen at the end of round k, RobustFind would need to return at least 
31^/100 wrong indices, namely i e [n] (~l S such that Xi — Xi (returning a _L 
here does not count as a false index). However, as the probability of a wrong 
index is at most 1/100 and RobustFind is called tk times, then, by Chernoff, 
the probability of Gk is e~ n( - tk \ 

Assume now that \x © x s \ > 30ife/100 at the beginning of round k. Recall 
also that by the assumption that Gk~i occurs, we have \x © x s \ < 60tfc/100 
at the beginning of the fcth round. Consider the first h = \x © x s \ — ifc/200 
calls for RobustFind. In each of those calls \x © x s \ > t/c/200 = /3fen, hence 
with probability 99/100 every such call returns an index i £ [n]flS which is 
then a correct index with probability 99/100. Thus we expect that at least 
• h correct indices will be returned in the first h calls. By Chernoff, the 
probability that the number of correctly returned indices in those h calls is less 
than 90ft./100 is e - a(tfe) (as h > 15i fc /100). But if the number of correctly 
returned indices is at least 90/i/100, then after the first h calls of RobustFind, 
\x © x s \ < 0.2h < 0.2 • 59£fc/100 < 12£ fc /100. Thus, at this point we are still 
left with 3tk/2 — h calls to RobustFind which will result in Gk only if at least 
48£fc/100 wrong indices will be returned. This again will happen with probability 
e -n(t k )_ We conc i u de that in all cases Pr[G fc |G fc _i] = e ~ n{ - tk \ 

Note that tk > t/(\og 2 t). Thus if we choose t > t such that for every fc 
the probability Pr[G fc |G fc _i] = e~°( tfc ) < l/(10i) we get that Pr[G fc ] < 1/10 for 
fc = log 2 t after the end of Part 2. Hence, with probability at least 0.8, we have 
\x © x\ < t/(\ogt) 2 bad indices at the end of the for loop in lines 17711771 

Finally, in Part 3 we find (with probability close to 1) all remaining wrong 
indices by making the individual error probability in RobustFind so small that 
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we can use the union bound: we determine each of the remaining bad indices 
with error probability 1 / (lOt). This implies an overall success probability of at 
least 0.8 • 0.9 > 2/3. 

Complexity. Clearly the complexity is determined by Parts 2 and 3 of the 
algorithm. We bound the number of queries to / in lines 11-17 as follows: 

/log(log 2 t) \ /log(log 2 t) j— F \ 

o[ E WOTUof s ^v ! f) =0 (^) (1) 

The number of queries in lines 18-21 is bounded by 




Therefore, the total query complexity of Alllnputs is 0(^/ni). 

4 Making Quantum Algorithms Robust 

4.1 Inputs computed by quantum algorithms 

Here we state a few corollaries of Theorem [21 First, once we have recovered the 
input x we can compute any function of x without further queries, hence 

Corollary 2 For every f : {0,1}™ — > {0,1}, there is a robust quantum algo- 
rithm that computes f using 0(n) queries. 

In particular, Parity can be robustly quantum computed with O(n) queries 
while it takes fl(n\ogn) queries classically [5]. 

Second, in the context of the direct-sum problem, the complexity of quantum 
computing a vector of instances of a function scales linearly with the complexity 
of one instance. 

Corollary 3 (Direct Sum) If there exists a T -query bounded-error quantum 
algorithm for f , then there is an 0(Tn)-query bounded-error quantum algorithm 
for n independent instances of f . 

As mentioned, the best classical upper bound has an additional factor of logn, 
and this is optimal in a classical black-box setting. 

Thirdly, all symmetric functions can be computed robustly on a quantum 
computer with the same asymptotic complexity as non-robustly. A function is 
symmetric if its value only depends on the Hamming weight of the input. Let 
r(/) := min{|2/c — n + 1| : / changes value if the Hamming weight of the input 
changes from k to k + 1}. Beals et al. Theorem 4.10] exhibited a bounded- 
error quantum algorithm for / using 0(y/n(n — T(f) + 1)) quantum queries, 
which is optimal. We show that this upper bound remains valid also for robust 
algorithms. 
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Theorem 5 For every symmetric function f , there is a robust quantum algo- 
rithm that computes f using 0(y/n(n — T(f) + 1)) quantum queries. 

Proof. Note that / is constant when the Hamming weight of its input lies in 
the middle interval [(n — T(/))/2, (n + — 2)/2]. Using two applications 
of Theorem [3] with sufficiently small error probability, we robustly search for 
\(n - r(/))/2] ones and n - \(n + T(f) - 2)/2] zeros in the input. If both 
of these searches succeeded (i.e., found the required zeros and ones), then we 
know that our input lies in the middle interval. If the search for zeros failed 
(i.e., ended with fewer zeros) then we know all zeros and hence the whole input 
x. Similarly, if the search for ones failed then we know x. Either way, we can 
output f(x). □ 



4.2 Multiple noisy copies 

As mentioned in the introduction, the assumption that we have a bounded-error 
algorithm Ai for each of the input bits Xi also covers the model of |l^j where 
we have a sequence yi,i, ■ ■ ■ ,yi, m of noisy copies of Xi. These we can query by 
means of a mapping 

|i)li>|o> ~ \i)\j)\yi,j). 

Here we spell out this connection in some more detail. First, by a Chernoff 
bound, choosing m := O(log(n)/e 2 ) implies that the average y.^ := J^^JLi Vi,jl m 
is close to Xi with very high probability: 

Pr[|ft - Xi \ > 2e] < 



lOOn 



By the union bound, with probability 99/100 this closeness will hold for all 
i £ [n] simultaneously. Assuming this is the case, we implement the following 
unitary mapping using one query: 



Ai : |0 log(m)+1 ) 



m 

-/=yZ\j)\vi,]) 



Measuring the last qubit of the resulting state gives Xi with probability at least 
1 — 2e. Hence, we can run our algorithm from Section [3] and recover x using 
0(n) queries to the y^j. Similarly, all consequences mentioned in Section 14.11 
hold for this multiple-noisy-copies model as well. 



5 Making Approximating Polynomials Robust 

The next theorem follows immediately from earlier results. 
Theorem 6 rdeg lj2 (/) = O(n) for every f : {0, 1}™ -> {0, 1}. 
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Proof. By Corollary [21 and the discussion in Section FOl / has an 0(n)-query 
robust quantum algorithm in the multiple-noisy-copies model that operates on 
O(logn) copies. By Lemma|5|this induces a type-1 robust polynomial for / of 
degree O(n). And finally, by Corollary ^ there also exists a degree-O(n) type-2 
robust polynomial for /. □ 

In particular, this shows that for functions with approximate degree 0(n) we 
can make the approximating polynomial robust at only constant factor overhead 
in the degree. This case includes explicit functions like Parity and Majority, 
but also random (hence almost all) functions. It is open whether approximating 
polynomials can always be made robust at only a constant overhead in the 
degree. The best we can do is show that a non-robust degree-d approximating 
polynomial can be made robust at a cost of a factor 0(logc?). Our proof makes 
use of the well known notion of certificate complexity. 

Definition 6 An assignment C : S — * {0, 1} of values to some subset S C [n] 
of the n variables is consistent with x £ {0,1}" if Xi — C(i) for all i G S. 
For b S {0, 1}, a 6-certificate for f is an assignment C such that f{x) = b 
whenever x is consistent with C. The size of C is \S\, the cardinality of S. The 
certificate complexity C x (f) of / on x is the size of a smallest f (x)- certificate 
that is consistent with x. The certificate complexity of f is C(f) = max x C x {f). 

Lemma 3 Letp be an e- approximating polynomial for f : {0, 1}™ — > {0, 1}, and 
c = C(f) be the certificate complexity of f. If x 6 {0, 1}" and z 6 [0, 1]" satisfy 
\H -Zi\< l/(10c) for all i e [n], then \p(z) - f{x)\ < 6e/5 + 1/10. 

Proof. Consider a certificate C for x of size c. We will use x and x c to denote 
the parts of a; corresponding to C and to its complement, respectively, and write 
x = x c x c . If y e {0, 1}™ is chosen according to the z-distribution (y, = 1 with 
probability Zi), then 

P (z) = E>(y)] = Pr k/ C ] ^[y u ]p(y c y u ) = ]T pr ^ ■ VbKiW)]- 

yCyC yC 

Now consider the expectation E y c[p(y c 'y c )], where y c £ {0, l} n_c is fixed, 
while the y -bits are still chosen according to the ^-distribution. Consider the c- 
variate polynomial obtained from p by fixing the bits in y c . Since the "error" in 
the z c -variables is at most l/10c, we have Pi[y c = x c ] > (l-l/(10c)) c > 9/10. 
If y c 7^ x c , then the difference between p{y c y G ) and p{x c y c ) is at most 1 + 2e, 
so _ 

I V [p(y c y c )} - p(x c y c )\ < (1 + 2e)/10. 

But f(x c y c ) — f(x), because the input x c y c is consistent with the same 
certificate as x. Hence 

\E y c\p(y c y°)]-f(x)\ < \E y a\p(y c y^)]-p(x c y U )\+\p(x c y^)-f(x)\ 
< (l + 2e)/10 + e = l/10 + 6e/5, 

and also \p(z) - f(x)\ < 6e/5 + 1/10. □ 
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This lemma implies that we can make a non-robust approximating polynomial 
robust at the cost of a factor of 0(logC(/)) in the degree: replace each vari- 
able by an 0(log C(/))-degree amplification polynomial as used in the proof of 
Lemma ^ Since it is known that C(f ) and deg(/) are polynomially related 
(C(/) = 0(deg(/) 4 ), see gj), we obtain: 

Theorem 7 rdeg 1)2 (/) = 0(deg(/) • logdeg(/)). 

6 Open Problems 

We mention some open problems. First, in contrast to the classical case (Parity) 
we do not know of any function where making a quantum algorithm robust costs 
more than a constant factor. Such a constant overhead suffices in the case of 
symmetric functions and functions whose approximate degree is Q(n). It is 
conceivable that quantum algorithms (and polynomials) can always be made 
robust at a constant factor overhead. Proving or disproving this would be very 
interesting. 

Second, we are not aware of a direct "closed form" or other natural way 
to describe a robust degree-n polynomial for the parity of n bits, but can only 
infer its existence from the existence of a robust quantum algorithm. Given 
the simplicity of the non-robust representing polynomial for Parity, one would 
hope for a simple closed form for robust polynomials for Parity as well. 

Finally, we have chosen our model of a noisy query such that we can coher- 
ently make a query and reverse it. It is not clear to what extent non-robust 
quantum algorithms can be made resilient against decohering queries, since the 
usual transformations to achieve fault-tolerant quantum computation do not 
immediately apply to the query gate, which acts on a non-constant number of 
quantum bits simultaneously. 
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Procedure 1: Alllnputs(n, t, A, e) 
n, t e N, A : n algorithms, e > 
l: x <- 0" 

Part 1, Aim: to find a set of indices S C [n] i/iai contains at least 
min(|x|,i) and at most it/2 l's of £/ie mpuf. 
2: for 3i/2 times do 

3: i <- RobustFind(n,.4(x),e, y^, y^) 
4: if i then 

6: 5 <— {« | X, = 1} 

7: if |5| < 5t/4 then 
8: S* <- [n] 

Part 2, Aim: correctly find all but t/ log 2 i 1 's. 

9: ^ Toon 
10: x^O™ 

11: for k <— 1 to log((logi) 2 ) do 

12: /3fc <- /3/2 fc 
13: tfc <- 3t/2 fc 

14: for £ <— 1 to t k do 

15: i <— RobustFind(n,.4 s (x),e, jig, y^y) 

16: if i then 

17. ^~ 1 " i 

Part 3, Aim: correctly find all other 1 's and get rid of remaining errors. 
18: for m <— t/(logi) 2 down to 1 do 
19: i <- RobustFind(n,.4' s '(x),e, ^, ^) 
20: if 2 7^_L then 

21. ■3^2 ^ 1 " " 

22: return x 
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